audioscrobbler password saved as plaintext in gconf

Agreed, rhythmbox should use the gnome keyring to store passwords.

Thank you for your bug. That's known upstream: http://bugzilla.gnome.org/show_bug.cgi?id=349132

You technically only need to store md5sum of the password, since that's all that's needed to perform a handshake with last.fm servers...
That md5 sum still ought to be stored in gnome keyring, since it could be used by anyone to scrobble/listen to users account... However md5 sum cannot be used to login to the last.fm website...

Okay, after reading the upstream bug, the idea of using the md5 is being criticized because you can still log into the site. First, Jonas claims this isn't even true. Second, as others have mentioned, people might be using the same password for another site and as such compromising this password could be a serious issue.

I would recommend applying the patch provided upstream (against 11.2, I would guess it would apply to 11.5 with proper offsets) to store the md5 instead of the password. This would at least reduce the issue. Then it should also be stored in gnome-keyring but the issue wouldn't be as immediate IMO.

Can anyone attempt to apply the patch and give us access to a test package via PPA?

Actually, this would be a good project for me, in order to learn how to do these sorts of things, so I will attempt to get a package up with the md5 patch in the next day or two.

@Mike any movement on the patch?

On Thu, Sep 11, 2008 at 1:49 AM, Daniel T Chen <email address hidden> wrote:
> @Mike any movement on the patch?

Thanks for the reminder Daniel, I'll take another look at it for Intrepid.

Five chunks of the patch failed (it looks like there has been some rework/updating in the plugin since this patch was made), so I had to do some of it by hand, making a guess or two at behavior. I am going to try compiling the new plugin and seeing if it works, and/or submitting it upstream for a review.

Alright, here is the patch I came up with (also sent upstream). It seems to work in that new passwords are stored as md5 and existing plaintext ones are converted, and tracks are successfully sent to last.fm.

Daniel, you seem to have some experience in this area, any hints for a first time contributor? Should I attempt to get a PPA up to ease testing? Or what is the next step?

Hi Mike,

If you want more testing, I uploaded a version in my PPA : https://launchpad.net/~gilir/+archive
For me, seems to work just fine :)

This bug seems to be fixed in Karmic. Closing the report.

Applogies. Upstream comment indicates that this is not yet fixed, but will be fixed to using gnome keyring.

I just checked, apparantly the bug has been fixed upstream about a year ago...
I tested it locally and I can't seem to find the password stored locally anywhere.